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Introduction 


The Hong Kong Monetary Authority (“HKMA”) issued a consultation paper 
on 8 May 2020 on the Implementation of Mandatory Reference Checking 
Scheme to Address the “Rolling Bad Apples” Phenomenon (“Consultation 
Paper”). 


The three-month consultation period ended on 7 August 2020. The HKMA 
received a total of seven submissions. The respondents included industry 
associations, an Authorized Institution (“Al”), a professional body, and the 
Privacy Commissioner for Personal Data, Hong Kong (“PCPD”). The list of 
respondents is set out in Annex 1. 


This consultation conclusions paper (“Conclusions Paper”) summarises the 
key comments received from the respondents to the Consultation Paper, 
the responses of the HKMA to those comments, and the revised proposals 
for taking forward the Mandatory Reference Checking Scheme (“MRC 
Scheme”) to tackle the “Rolling Bad Apples” (“RBA”) phenomenon. The 
revised proposals have taken into account relevant work done by 
international bodies, local circumstances in Hong Kong, as well as 
comments from the respondents. As the MRC Scheme is intended to be an 
initiative to be taken forward by the industry, the revised proposals set out 
in this paper are subject to further modifications and refinements for 
implementation by the industry. It is proposed that an industry working 
group (“IWG”) be set up to work out the operational details of the MRC 
Scheme in accordance with the principles set out in this Conclusions Paper. 


This Conclusions Paper should be read together with the Consultation 
Paper. A summary of the major comments received and the HKMA’s 
responses are discussed below. More details on the consideration of the 
industry’s comments are set out in tabular form in Annex 2 and a summary 
of PCPD’s comments is appended in Annex 3. 


Il. Comments and Conclusions 


5. In general, the seven submissions expressed support for the 
implementation of the MRC Scheme by Als with respect to their 
employment of individuals to specified positions, with a view to addressing 
the RBA phenomenon (i.e. individuals who engaged in misconduct during 
their employment in the institutions but are able to obtain subsequent 
employment elsewhere without disclosing their earlier misconduct to the 
new employer). Respondents have also provided comments on some 
practical and implementation aspects of the MRC Scheme and sought 
clarifications on certain areas. In addition to the respondents from the 
industry, we would also like to extend our appreciation to PCPD for 
providing valuable comments on the protection of personal data privacy in 
respect of the MRC Scheme. 


6. We have taken into account all the comments received in refining the 
proposals for the MRC Scheme. Some of the key comments and our 
responses are highlighted in the paragraphs below, and more details are set 
out in Annex 2, while a summary of PCPD’s comments is appended in 
Annex 3. 


Scope of Personnel to be Covered 


Respondents generally supported the adoption of a _ phased 
implementation approach. They also generally supported the scope of 
personnel proposed for Phase 1 of the MRC Scheme. Some respondents 
expressed concern over the wider scope of personnel proposed to be 
covered in Phase 2 of the MRC Scheme, in particular the inclusion of client- 
facing staff. They considered that including client-facing staff in the MRC 
Scheme would induce heavy operational burden on banks and significantly 
increase the number of employees who will be subject to the MRC process, 
and such operational impact may not be commensurate with the entailed 
risks. Some respondents suggested that the scope of Phase 2 of the MRC 
Scheme be confined to employees who are licensed with financial 
regulators. In view of these comments, the HKMA has refined the proposal 
for Phase 2 to extend the scope of personnel covered in Phase 1 to only 
also cover individuals who are registered or licensed with financial 
regulators. In other words, the revised coverage of Phase 2, in addition to 
personnel covered in Phase 1, would be: (i) staff licensed to carry out 
securities related regulated activities under the Securities and Futures 
Ordinance (“SFO”); (ii) staff licensed to carry out insurance related 
regulated activities under the Insurance Ordinance (“lO”); and (iii) staff 
registered to carry out regulated activities under the Mandatory Provident 
Fund Schemes Ordinance (“MPFSO”). The inclusion of other roles under 
Phase 2 can be further considered by the IWG having regard to the 
experience in Phase 1. 


Some respondents also noted that the roles of “heads and deputy heads of 
key supporting functions”, as proposed to be covered in Phase 2 in the 
Consultation Paper, will largely overlap with “managers” under §72B of the 
Banking Ordinance (“BO”) who are already covered in Phase 1. They also 
noted that there might be interpretation issues on the roles of “deputy 
heads” given that different Als may have different job specifications and 
titles. For simplicity and to avoid misinterpretation issues, the HKMA has 
removed the roles of "heads and deputy heads of key supporting functions” 
from MRC coverage under Phase 2. 


One respondent suggested adding the role of “responsible officer” (“RO”) 
approved under the MPFSO to the MRC Scheme, as roles of similar nature, 
such as “executive officer” (“EO”) approved under the BO and RO approved 
under the IO, are covered under the MRC Scheme. In view of these 
comments, the HKMA has added ROs under the MPFSO to the MRC Scheme. 
Moreover, considering that ROs under the IO and the MPFSO are important 
roles in Als who are usually expected to be appointed on a long-term basis, 
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ROs under both the IO and the MPFSO are moved to Phase 1 of the MRC 


Scheme. 


10. The changes in the scope of personnel covered are summarised in the table 











below: 
Table 1 —- Amendments to the scope of personnel 
Original Proposal Revised Proposal 

Phase 1 Directors* Directors 

CEs, ACEs? CEs, ACEs 

§72B managers §72B managers 

EOs? EOs 

ROs under IO and MPFSO 

Phase 2 Heads and deputy heads of Staff licensed or registered 


key supporting functions 
Staff licensed or registered 
to carry out regulated 
activities under SFO, IO and 
MPFSO* 

ROs under IO 

Client-facing staff who 
provide general banking 
products and services (i.e. 
bank branch managers, 
tellers and customer 
relationship 
representatives) 


to carry out regulated 
activities under SFO, IO and 
MPFSO 





1 Refers to directors approved under §71 of the BO. 
2 Refers to chief executives (“CEs”) and alternate chief executives (“ACEs”) approved under §71 of the 


BO. 


3 Refers to executive officers (“EOs”) approved under §71C of the BO. 

4 Includes staff licensed to carry out securities related regulated activities under the SFO, staff licensed 
to carry out insurance related regulated activities under the IO (i.e. technical Representatives 
licensed by the IA under §64Y or §64ZC of the IO); and staff registered to carry out regulated 
activities under the MPFSO (i.e. subsidiary intermediaries registered with the Mandatory Provident 
Fund Schemes Authority (“MPFA”) under §34U(4) of the MPFSO). 
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2. 


11. 


12. 


Scope of MRC Information 


Respondents generally supported the proposed scope of MRC information. 
Most respondents, however, expressed concerns about disclosing ongoing 
investigations as MRC information. While the proposal as set out in the 
Consultation Paper provides flexibility for the reference providing Al to 
decide whether to disclose ongoing investigations taking into account the 
circumstances of individual cases, most respondents expressed concerns 
that such disclosure may pose potential litigation risks to Als, and that it 
may affect ongoing investigations, in particular those involving regulatory 
bodies or a suspected offence. Some respondents considered that 
disclosing ongoing investigations may also be unfair to the individuals 
concerned. In this connection, some respondents proposed that disclosure 
should be confined to concluded investigations only. On a related note, 
some respondents sought clarification on the timeframe for reference 
providing Als to provide notifications to recruiting Als on concluded 
investigations. 


In view of the industry’s comments, the HKMA considers that the issue of 
the reporting of ongoing investigations could be further deliberated by the 
IWG to be established. On the one hand, there are constraints and 
potential legal implications associated with disclosure of ongoing and 
incomplete investigations by the reference providing Als to the recruiting 
Als. On the other hand, if all ongoing and incomplete investigations are 
excluded, it may give rise to a potential loophole for the “bad apples” to 
resign from the current job once an investigation of their misconduct is 
started or is about to conclude with likely disciplinary actions, thereby 
bypassing the MRC Scheme and escaping from the consequences of their 
misconduct behaviour. The HKMA considers that in principle the reference 
providing Als should provide information about ongoing investigations with 
allegations that are of serious nature as well as those which are about to 
conclude with disciplinary actions. The MRC information so provided may 
contain basic information about the allegations and the state of 
investigation. As the prospective employee will be given an opportunity to 
be heard, it will be up to the recruiting Al to take into account the 
information available before making the recruitment decision. This would 
help strike a balance between mitigating Als’ litigation risks and addressing 
the risk of hiring “bad apples”. The IWG may duly consider the matter and 
prepare guidance on the types of ongoing investigations that should be 
included as well as the exemptions that should be applied, for instance due 
to statutory prohibitions, taking into account the above considerations as 
well as views of the industry participants. As regards the timeframe to 
provide notifications of concluded investigations, it is proposed that 
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13. 


14. 


15. 


16. 
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reference providing Als should provide an update to a recruiting Al on 
concluded investigations, i.e. cases where the individual is found guilty of 
misconduct, within one month after the cases are concluded. 


Some respondents suggested defining a materiality threshold for 
reportable misconduct, where reportable events would be confined to 
those of serious nature meeting the materiality threshold. One respondent 
suggested attaching a monetary value threshold for such reporting. The 
HKMA considers that setting up an industry-wide quantitative materiality 
threshold may not be appropriate given the scale of business of Als varies. 
However, we agreed that reportable information should be confined to that 
which is material or serious in nature and should generally fall under items 
stated in paragraph 35 (i) to (v) in the Consultation Paper’. More practical 
guidance on what constitutes reportable information can be further 
deliberated by the IWG. 


Some respondents expressed concern that disclosure of misconduct may 
unveil proprietary information, internal control deficiencies or business 
secrets of the reference providing Als. In this regard, reportable 
information should focus on the misconduct activities committed by the 
individual concerned rather than details of proprietary or sensitive 
commercial information of the Al concerned. 


Respondents also sought clarification on the definition of “internal 
disciplinary actions” that are reportable under the MRC Scheme. For the 
purpose of the MRC Scheme, internal disciplinary actions should include 
actions that are taken by the Al against the employee as a result of 
misconduct on the part of the employee. Generally speaking, internal 
disciplinary actions may include internal warnings (either in written or 
verbal form); financial penalty involving remuneration; and suspension and 
dismissal as a result of misconduct. For the purpose of the MRC Scheme, 
internal disciplinary actions do not include managerial coaching and 
counselling, suspensions pending investigations, or leaves taken while 
investigations are being carried out. 


Some respondents noted that the reference providing Al may not have 
sufficient information on external disciplinary actions for MRC reporting 
purposes, as such information may not be publicly available. The HKMA 
considers that external disciplinary actions refer to those taken by 


Paragraph 35 of the Consultation Paper sets out the following items: 

(i) breach of legal or regulatory requirements relating to the BO, IO, MPFSO and SFO; 
(ii) incidents related to honesty, integrity or matters of similar nature; 

(iii) misconduct reports filed with the HKMA; 

(iv) internal or external disciplinary actions arising from conduct matters; and 

(v) any other additional information relevant to the fit and proper assessment. 
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regulatory bodies, industry associations and professional bodies against 
the individual during his/her employment with the reference providing Al. 
The expectation of the HKMA is that reference providing Als will, on a best 
endeavour basis, report external disciplinary actions that have been made 
known to the public. Reference providing Als are not expected to conduct 
a search on behalf of the recruiting Al for actions taken against the 
individual outside of his/her employment period. 


17. 


Duration of MRC Information 


The Consultation Paper proposed that MRC information should cover 
employment records of 10 years up to the date of the individuals 
application for employment with the recruiting Al. This proposal made 
reference to the current HKMA requirement for individuals to disclose 10 
years of employment records in their applications for the positions of 
directors, CEs, ACEs and EOs at Als. In this respect, the PCPD noted that as 
the MRC Scheme is conducted for the legitimate purposes of tackling the 
RBA issue and enhancing integrity of the banking industry, there are 
subsisting reasons for Als to retain MRC-related employment data for 
longer than the 7-year retention period applicable otherwise. However, 
respondents generally considered it onerous to retain 10 years of 
employment records in order to meet the requirements of the MRC 
Scheme as the conventional practice of employment record retention is 
only 7 years. They noted that the operational and resources implications 
would be higher if they are required to retain employment-related data for 
more than 7 years, and it may deny employees of a rehabilitation 
opportunity. The HKMA has duly considered the industry’s comments and 
is of the view that the employment records retention period can be 
reduced to 7 years for Phase 1 and Phase 2 of the MRC Scheme, subject to 
further deliberation of the IWG. 


18. 


19. 


20. 


21. 


Obligations of Recruiting Als 


Most of the respondents agreed that consent should be obtained from the 
prospective employee before the recruiting Al initiates a reference check. 
They suggested that a standard written consent template would be useful 
so that a consistent approach can be applied across the industry. The 
HKMA suggests that the IWG may take the lead to develop an industry 
standard template to facilitate the operation of the MRC Scheme. 


Some respondents expressed that recruiting Als may face practical 
difficulties in obtaining the prospective employee’s consent to request 
MRC information from his/her current employer as this would inevitably 
expose the prospective employee’s intention to change job which in turn 
may affect the current employment relationship if the prospective 
employee eventually cannot secure a job offer from the recruiting Al. 
Taking into account the feedback received, a possible solution would be for 
the recruiting Al to consult and coordinate with the prospective employee 
on the appropriate timing for sending out the MRC requests. For example, 
the recruiting Al may first proceed to obtain MRC information from the 
prospective employee’s former employers and conduct the MRC process 
based on such information. If the MRC process is cleared, the recruiting Al 
may make a conditional offer to the candidate. The recruiting Al may then 
send out the MRC request to the candidate’s current employer and carry 
out the remaining MRC process, subject to which the employment decision 
can be finalised. This arrangement may help address the candidate’s 
concern as indicated above. 


Some respondents asked whether recruiting Als are required to complete 
all the MRC processes before making employment decisions. Generally 
speaking, recruiting Als are strongly encouraged to complete all the MRC 
processes before on-boarding prospective employees. In cases where a 
recruiting Al would like to advance the employment decision before the 
completion of the MRC process, they may exercise flexibility by making a 
conditional offer or requiring the prospective employee to provide a self- 
declaration that he/she has not been involved in any misconduct incidents 
or subject to any material disciplinary actions, while pending the 
completion of the MRC processes. 


Some respondents sought clarification on whether there would be any 
legal and/or regulatory consequences to the recruiting Al if it chooses to 
hire an individual despite being informed about misconduct in the 
individual’s employment history, or if negative information is received after 
an employee has been on-boarded. The HKMA notes that except for the 
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22. 


23. 


appointment to some senior positions that requires regulatory approvals, 
Als will have discretion on their employment decisions, including whether 
to rescind an offer of employment or to continue to proceed with the 
employment. If Als choose to proceed with the employment of an 
individual notwithstanding the negative MRC information received, Als 
should document the justifications and should take such information as a 
red flag that may warrant a greater scrutiny on possible conduct risks that 
may be posed by such individuals. Depending on the nature and severity 
of the prior misconduct activity, this should inform Als of possible 
mitigating measures. 


The Consultation Paper proposed that an opportunity to be heard should 
be given to the prospective employee by the recruiting Al in case there is 
any negative information about the candidate being received from the 
reference providing Al. While the PCPD agrees that such proposal would 
be in line with the requirements related to the right to request correction 
of inaccurate personal data under the Personal Data (Privacy) Ordinance 
(“PDPO”), most of the respondents considered that recruiting Als should 
not be obliged to provide an opportunity to be heard in all circumstances 
as the process may involve disclosing information and potentially lead to 
breach of statutory secrecy obligations or other confidentiality agreements. 
Also the divulgence of MRC information may tip off the individual 
concerned and compromise the quality of any ongoing investigation. 
Having considered the industry’s comments, the HKMA maintains the view 
that on the ground of fairness to the prospective employee, an opportunity 
to be heard should generally be provided, including but not limited to cases 
where the misconduct incident has been substantiated, or where external 
or internal disciplinary actions have been taken against the individual. As 
for cases where there are legal impediments for disclosure to the 
prospective employee in the course of providing an opportunity to be 
heard (such as alleged misconduct cases that are still under confidential 
investigation, cases involving sensitivity concerning secrecy or potential 
tipping off, and cases with other potential legal implications, etc.), it would 
be appropriate for the proposed IWG to consider the practical issues in 
more detail taking into account PCPD’s views. 


One respondent sought clarification on whether Als can outsource the MRC 
process to external services providers. Depending on business needs and 
similar to the existing arrangements of some Als which outsourced their 
human resources (“HR”) management related functions, Als may outsource 
their MRC process to external services providers as long as the Als remain 
ultimately responsible for ensuring compliance with the relevant 
supervisory requirements applicable to outsourcing. In particular, Als 
should have contractual arrangements and relevant controls measures in 
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place to safeguard the security and storage of data to prevent data leakage 
if outsourcing is adopted. 
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24. 


25. 


26. 


Obligations of Reference Providing Als 


On the timeframe for reference providing Als to respond to a MRC request, 
most of the respondents considered that 10 working days would not be 
sufficient as some Als may have lean HR department setup where handling 
of staff records may involve other functional departments within the Al in 
addition to the HR department. Some respondents considered that the 
MRC Scheme would cause a delay in the hiring process. The HKMA 
considers it important to strike a balance between operational needs and 
efficiency in handling the MRC request. Taking into account industry 
concerns, the HKMA agrees that the timeframe for reference providing Als 
to respond to an MRC request can be lengthened, say to one month, 
counting from the day the MRC request is made by the recruiting Al. We 
believe that the revised proposal of a response time of one month would 
not cause significant delay in the hiring process. The HKMA encourages the 
industry to set up and maintain a list of contact points of individual banks 
for the purpose of MRC process to facilitate efficient communication and 
information exchange among Als. Refinements to the response time can 
be considered by the IWG having regard to industry feedback and 
operational experience. 


Some respondents sought clarifications on scenarios where the reference 
providing Al should provide updates on an earlier MRC report to a 
recruiting Al. As a general rule, an update should be provided if it may lead 
to substantive changes to the reference information previously provided. 
In determining whether an update is necessary, the reference providing Al 
should consider factors such as the role of the former employee in the 
misconduct case and seriousness of the incident, etc. 


Some respondents raised questions about the handling arrangements if a 
reference providing Al fails to provide a response to the MRC request within 
the specified response period, i.e. one month. As noted in paragraphs 50 
and 51 of the Consultation Paper, reference providing Als should normally 
respond within the specified response period. However, if they encounter 
genuine difficulties which render them unlikely to be able to observe the 
specified period of one month, they should provide an interim reply to the 
recruiting Al before the lapse of the specified period setting out the reasons 
for the longer time required and an estimated timeframe for providing a 
response. The recruiting Al would be considered to have discharged its 
obligations under the MRC Scheme if it does not receive any MRC 
information from the reference providing Al after one month or a longer 
period mutually agreed by both parties. 
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27. In cases where Als observe repeated failures of a particular Al to respond 
to MRC requests, such a matter can be raised to the IWG for follow-up and 
any unresolved matter can be brought to the attention of the HKMA 
through the IWG. Repeated failures may indicate potential weaknesses on 
the governance arrangements as well as the internal controls and 
procedures of the Al, and the HKMA may follow up with the Al concerned 
accordingly. 
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Ill. Implementation Approach and Next Steps 


28. 


29. 


30. 


31. 


As noted in the Consultation Paper, the HKMA’s intention is that instead of 
introducing the MRC Scheme as a supervisory requirement, the 
development and implementation of the MRC Scheme should be an 
industry-led initiative to be endorsed by the HKMA, with a view to assisting 
the banking industry in tackling the RBA phenomenon on an industry-wide 
basis. The experience gained by the industry in their operation of the MRC 
Scheme can usefully inform the review of the implementation of Phase 1 
and the consultation for Phase 2. 


Following the issuance of this Conclusions Paper, the HKMA will invite the 
Hong Kong Association of Banks (“HKAB”) to set up an IWG to work out the 
details of the MRC Scheme that is in line with the principles set out in this 
Conclusions Paper. The IWG will also facilitate the operation of the MRC 
Scheme; provide a platform for gathering industry feedback on MRC 
implementation issues on an ongoing basis; and explore the benefits and 
feasibility of further approaches and technological solutions to address the 
RBA phenomenon in the longer term, including the possibility of 
establishing a central register (“CR”) for the MRC Scheme to be developed 
and operated by the industry. 


The IWG is expected to deliver the operational details of the MRC Scheme 
within 6 months upon issuance of this Conclusions Paper. On the timeline 
for the implementation of Phase 1 of the Scheme, the HKMA noted the 
industry’s request for a transition period to commence upon the HKMA’s 
endorsement of the operational details proposed by the IWG so as to allow 
sufficient time for Als to set up their internal processes and procedures for 
the MRC Scheme. The IWG may further deliberate on the detailed 
implementation timeline of the MRC Scheme in consultation with the 
HKMA. 


It was proposed in the Consultation Paper that a review on the 
implementation of Phase 1 would be conducted one year after the launch 
of Phase 1. Most respondents however considered it preferable for the 
review to be conducted two years after implementation of Phase 1 in order 
to allow more time to test their internal processes as well as to gain 
practical experience given that the turnover rate of Phase 1 personnel 
would likely be relatively low. They also suggested that a second round of 
consultation be held before Phase 2 implementation. Having considered 
these comments, the HKMA is of the view that a Phase 1 review could be 
conducted two years after implementation of Phase 1. A consultation on 
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Phase 2 would be conducted in conjunction with the review before the 
implementation of Phase 2. Subject to the outcome of the review of Phase 
1 and the corresponding consultation on Phase 2, the implementation 
details of Phase 2 will be formulated accordingly. 
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Annex 1 — List of Respondents 


(in alphabetical order) 


ed ae ae 


Asia Securities Industry & Financial Markets Association 
Clifford Chance 

Privacy Commissioner for Personal Data, Hong Kong 
Private Wealth Management Association 

Svenska Handelsbanken AB (publ.) 

The DTC Association 

The Hong Kong Association of Banks 
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Annex 2 — Summary of Industry’s Comments and HKMA’s Responses 





# Comments / questions from respondents 


HKMA’s response 





Q1. Do you have any comments on the proposed phased implementation approach? 





1. | No particular comments received. 


N/A 





Q2. Do you have any comments on the respective scope of personn 
MRC Scheme? 


el proposed to be covered by Phase 1 and Phase 2 of the proposed 





2. | Treatment of existing employees 

Some respondents sought clarifications on whether the MRC 
Scheme will also cover existing employees. One respondent 
suggested that the scope should be expanded to cover not only 
prospective employees applying for in-scope positions, but also 
existing employees who are employed in those specified 
positions. One respondent sought clarifications on whether 
MRC Information previously gathered by a recruiting Al could be 
“recycled” within the Al if an individual leaves the Al but rejoins 
multiple times over the specified period. 


The MRC Scheme primarily serves to facilitate Als in making 
employment decisions, thus it is not necessary for Als to conduct 
MRC on existing employees who currently hold in-scope roles. The 
MRC Scheme will only apply to new hires but not to existing 
employees who currently hold in-scope roles. 


For an individual who leaves an Al but rejoins multiple times over the 
7-year period, the recruiting Al can make use of previous MRC 
Information it had gathered on the individual and conduct MRC on 
other relevant employment records that were not covered in the 
previous check. 








In-scope personnel for Phase 2 

Most of the respondents considered having the MRC Scheme 
cover client-facing staff to be too broad and would induce heavy 
burden on banks and significantly increase the number of 
employees who will be subject to the MRC process. They also 
considered there is no pressing need to address RBA for junior 
staff. Some of the respondents suggested that Phase 2 of the 
MRC Scheme be confined to staff who are licensed with financial 





In view of comments that a relatively broad scope of coverage of 
client-facing staff could induce heavy resource and operational 
burden on Als, and that the risks posed by RBA are higher for licensed 
roles, it is proposed that Phase 2 should only extend the scope of 
personnel covered in Phase 1 to include employees who are 
registered or licensed with the local financial regulators as elaborated 
in paragraph 32 (ii) to (iv) of the Consultation Paper. The inclusion of 





other roles (including non-client facing roles) under the MRC Scheme 
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Comments / questions from respondents 


HKMA’s response 





regulators. One respondent suggested the inclusion of some 
non-client facing roles, such as settlement personnel, into the 
MRC Scheme. 


can be considered further by the IWG having regard to the 
experience in Phase 1. 











Intragroup move / promotions / cross-border application 
Most of the respondents sought clarification on whether the 
MRC Scheme will apply to internal transfers from within the 
same group of the recruiting Al, and to employees who are 
being promoted to in-scope roles. Some also had questions 
about the MRC Scheme’s cross-border application, say for 
employees based outside Hong Kong but with regional oversight 
functions in Hong Kong. 





Als within the same group may share common internal records or 
human resources functions. The MRC Scheme will allow flexibility for 
Als within the same banking group to perform reference checks using 
procedures other than those prescribed in the MRC Scheme as long 
as the relevant information can be obtained. The requirements 
relevant to the requesting or updating of MRC information can be 
carried out in a way that best suits the intragroup practice taking into 
account their Al’s group internal records, common human resources 
functions or other means for sharing relevant information. The onus 
will still be on the recruiting Al within the group to obtain the 
necessary information to satisfy its obligations to ensure the 
individual is fit and proper. 


For employees subject to intragroup transfers / promotions, such 
employees may have already established a track record after having 
served in the Al’s group for a considerable period of time. In such 
cases, Als can consider whether it is useful to conduct MRC on such 
employees to cover the time of their employment prior to joining the 
group, taking into account the number of years of experience that 
they have had in the Al’s group. 


At the initial stage, we are of the view that the MRC Scheme should 
be applied to Als in Hong Kong but not their head offices or branches 
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Comments / questions from respondents 


HKMA’s response 





outside Hong Kong given potential cross-boundary issues. The HKMA 
will keep in view the implementation of the MRC Scheme and 
consider whether to extend its coverage subject to discussion with 
the industry. 





Contract or temporary employee 

Some respondents considered that applying MRC to temporary 
and contract employees may be disproportionate to the 
duration of their tenure with the recruiting Al. Some considered 
that such employees are often recruited to promptly fill 
temporary vacancies, and that requiring recruiting Als to comply 
with the MRC Scheme requirements with respect to such 
employees would essentially deny them the ability to solve 
certain urgent and pressing personnel shortage. One 
respondent also raised that temporary human resources such as 
agency contractors, secondees, consultants or interns should be 
exempted as Als generally do not maintain full records of 
temporary employees or third-party contractors. 


The proposed in-scope personnel are generally those who may pose 
significant issues if the RBA phenomenon is not addressed properly, 
thus we consider it appropriate for the MRC Scheme to cover these 
roles as long as they fall within the scope of personnel of the MRC 
Scheme irrespective of the length of the employment. 


Employees that are on secondment or assigned by third parties to 
perform in-scope roles would be subject to the MRC Scheme and the 
reference check should be performed by the Al concerned or through 
other arrangements (such as outsourcing). The Als should be held 
ultimately responsible for the MRC process. To avoid causing an 
undue delay in filling pressing vacancies, Als can exercise discretion 
to determine the appropriate timing in conducting the MRC and may 
consider advancing hiring decisions to best suit their business or 
operational needs, see #53 on finalisation of employment decision 
for details. 











Information in relation to previous out-of-scope role 

Some respondents sought clarification on whether MRC 
information for out-of-scope role employees should be 
maintained and provided to recruiting Als for MRC purpose. 





The reference providing Als will need to provide recruiting Als with 
MRC information on individuals for role(s) that he/she held in the 
reference providing Al irrespective of whether such role(s) was in- 
scope under the MRC Scheme. 
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Comments / questions from respondents 


HKMA’s response 





Alignment of scope of Phase 1 and Phase 2 personnel with 
existing licensing and approval regimes of the HKMA and other 
regulators 

One respondent asked whether there is a need for individuals 
who are subject to the approval and licensing regimes of HKMA 
or other regulators to be covered under MRC Scheme, and if so 
how the MRC Scheme can be better aligned with the relevant 
licensing requirements. 


The MRC Scheme aims to help strengthen Als’ recruitment process 
and remove some obstacles that Als may face in assessing the fitness 
and propriety of prospective employees, including with respect to 
roles that require approvals from regulators, such that Als can play a 
more proactive role in tackling the RBA phenomenon. 


Given the MRC Scheme has yet to be implemented, further 
considerations about potentially streamlining the MRC Scheme with 
other related licensing requirements could be considered in the 
longer term taking into account implementation experience of the 
MRC Scheme. 





Overlap of heads / deputy heads of key supporting functions 
with §72B managers under the BO 

Some respondents considered that the role of deputy head is 
vague and may have different meanings across the industry, and 
that it can be exempted from the scope of MRC. Some noted 
that heads/deputy heads of key supporting functions as 
proposed to be covered in Phase 2 will largely overlap with §72B 
managers who are already covered in Phase 1. One respondent 
noted that individuals within the HR and legal functions of Als 
are currently unregulated, and that the inclusion of senior 
managers of these functions within the scope of the MRC 
Scheme would be unprecedented in Hong Kong. 


For simplicity and to avoid misinterpretation issues, the HKMA agrees 
to remove heads / deputy heads of key supporting functions from 
MRC coverage under Phase 2. The coverage of in-scope roles for 
Phase 2 can be further considered in the review to be conducted 
prior to Phase 2 implementation. 











Inclusion of ROs under the MPFSO under Phase 1 
One respondent noted that since EOs under the BO and ROs 





The HKMA agrees to include ROs under MPFSO in the MRC Scheme. 
As ROs under the IO and the MPFSO are important roles in Als, we 
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Comments / questions from respondents 


HKMA’s response 





under the IO fall under Phase 1 and Phase 2 of the MRC Scheme 
respectively, ROs under MPFSO should also be covered under 
the MRC Scheme. 


will bring ROs under the IO and the MPFSO under Phase 1 of the MRC 
Scheme. 





Q3. Do you have any comments on the proposed timeframe for implementation of Phase 2 following the launch of Phase 1? 











10. | Phase 1 implementation Upon the publication of the consultation conclusions, the HKMA will 
Respondents sought clarification on the timing for the | invite HKAB to set up an IWG to formulate the operational details of 
implementation of Phase 1. They considered that sufficient | the MRC Scheme in accordance with the principles set out in the 
time will be required by Als to set up internal operational | Conclusions Paper. Such operational details should be finalised 
processes to comply with the MRC Scheme requirement and to | within 6 months of the publication of the Conclusions Paper for 
conduct training for relevant staff. They proposed to set the | endorsement by the HKMA. On the timeline for the actual 
implementation date to be at least 12 — 18 months following the | implementation of the MRC Scheme, the HKMA noted the industry’s 
HKMA’s publication of the consultation conclusion. request for a transition period from the time that the operational 

details are endorsed by the HKMA, in order to provide sufficient time 
for Als to set up their internal processes and procedures for the MRC 
Scheme. The IWG may further deliberate on the implementation 
timeline of the MRC Scheme in consultation with the HKMA. It is 
envisaged that, following the implementation of the MRC Scheme, 
the IWG will also take the lead in conducting the review on the 
implementation of Phase 1 of the MRC Scheme. 

11. | Phase 1 review and Phase 2 implementation We agree that a review of Phase 1 could be conducted 2 years after 





Respondents noted that conducting a Phase 1 review after 1 
year of implementation would be insufficient to gain relevant 
experience and to test internal processes given the low turnover 
rate of Phase 1 personnel. They proposed to allow an additional 
year for the Scheme to operate before conducting a review on 


the implementation of Phase 1 to allow sufficient time to gain 
experience and to identify room for improvements. Consultation on 
Phase 2 implementation could be conducted in conjunction with the 
review on Phase 1, following which the operational details of Phase 
2 can be fine-tuned and confirmed for implementation accordingly. 
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Comments / questions from respondents 


HKMA’s response 





Phase 1. Respondents generally considered that a second round 
of consultation will be necessary before the launch of Phase 2 
so that the industry can be involved in the process given the 
anticipated complexity and the wider scope of coverage under 
Phase 2. Some respondents invited the HKMA to consider 
adopting a staggered approach to the implementation of Phase 
2 given the broad range of personnel it covers. 





Q4. Do you have any comments on the proposed scope of MRC information, in particular information relating to investigation in progress 
but not yet concluded? 








12. 





Disclosure and provision of updates related to ongoing 
investigation 

Most of the respondents expressed concerns about disclosing 
open investigations, as they may expose Als to potential 
litigation risks and that it may affect ongoing investigations, in 
particular those involving regulatory bodies or a suspected 
offence, and those where the investigation is expected to be 
conducted confidentially or is subject to secrecy requirements 
under applicable laws. It may also be unfair to the individuals 
concerned. In this connection, some respondents proposed 
that disclosure be confined to concluded investigations only. On 
a related note, some respondents sought clarification on the 
timeframe for reference providing Als to provide notifications to 
recruiting Als on concluded investigations. 





In view of the industry’s comments, the HKMA considers that the 
issue of the reporting of ongoing investigations could be further 
deliberated by the IWG to be established. On the one hand, there 
are constraints and potential legal implications associated with 
disclosure of ongoing and incomplete investigations by the reference 
providing Als to the recruiting Als. However, on the other hand, if all 
ongoing and incomplete investigations are excluded, it may provide 
a potential loophole for the “bad apples” to resign from the current 
job once an investigation about their misconduct has been started or 
is about to conclude with likely disciplinary actions, thereby 
bypassing the MRC Scheme and escaping from the consequences of 
their misconduct behaviour. The HKMA considers that in principle 
the reference providing Als should provide information about 
ongoing investigations with allegations that are of serious nature as 
well as those which are about to conclude with disciplinary actions. 
The MRC information so provided may contain basic information 
about the allegations and the state of investigation. As the 
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prospective employee will be given an opportunity to be heard, it will 
be up to the recruiting Al to take into account the information 
available before making the recruitment decision. This would help 
strike a balance between mitigating Als' litigation risks and 
addressing the risk of hiring “bad apples”. The IWG may duly 
consider the matter and prepare guidance on the types of ongoing 
investigations that should be included as well as the exemptions that 
should be applied, for instance due to statutory prohibitions, taking 
into account the above considerations as well as views of the industry 
participants. 


As for the timeframe to provide an update on concluded 
investigations, reference providing Als should provide an update to a 
recruiting Al upon conclusion of investigation cases where the 
individual is found to have committed serious misconduct within one 
month after the cases are concluded. 








13. 





Internal informal review 


Some 


respondents sought clarification on 


whether 


investigations cover internal informal reviews and the types of 
investigations or reviews that would be captured by the MRC 


Scheme. 





In considering whether internal informal reviews or other forms of 
reviews concerning staff conduct matters should be covered under 
the MRC Scheme, Als should consider the context of such reviews. If 
the review aims to examine suspicious misconduct cases with prima 
facie evidence, then it should be considered as investigations. On the 
other hand, reviews conducted on the Als’ processes and controls, or 
general complaints with little prima facie evidence and subsequently 
found unsubstantiated, should generally not be considered as 
investigations. However, if such a review unveils that an individual 
may have been involved in misconduct, Als should conduct an 
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investigation accordingly. 


See #27 below for a non-exhaustive list of investigations. The IWG is 
invited to set out more specific criteria for the types of investigations 
or reviews to be included for reporting under the MRC Scheme. 





14. 


Employees working in multiple entities within a group 

One respondent sought clarification on cases where employees 
have employment records at multiple entities within a group, 
whether reportable information should be limited to his/her 
activities at Al(s) or should also cover those carried out at other 
affiliates within the group. One respondent suggested that a 
streamlined approach to request MRC information from 
different Als within the same group can be considered. 


The reference checking process is expected to be carried out on an Al 
entity basis. In other words, if the employee’s employment records 
span across various entities/branches/head office within a group, 
reportable information should be confined to the employee’s 
activities at the reference providing Al but not at other affiliates 
within the same group. The reference providing Al is considered to 
have discharged its obligations under the MRC Scheme so long as 
information within the reference providing Al (and not of its affiliates) 
have been provided to the recruiting Al. If a prospective employee 
has worked at more than one Al within a group, the recruiting Al 
should approach the different reference providing Als for MRC 
separately. 


The streamlined approach to group companies can be further 
considered by the IWG subject to the general feedback of the 
industry. 








15. 





Reason for the cessation of appointment 

On the MRC Information Template, one respondent sought 
clarification on the level of detail required in disclosing the 
reason for cessation of appointment of the individual 





As a general reference, it is considered sufficient for Als to indicate 
whether an employee resigned on his/her own accord or whether 
his/her employment was terminated by the Al with notice or 
summarily. 
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# Comments / questions from respondents HKMA’s response 
concerned. 

The IWG is welcomed to work out any reference template for 
standardisation of reply. 

16. | Scope of involvement Reportable information in MRC should cover employees who 
One respondent sought clarification on what constitutes | committed misconduct or were accomplices in the misconduct 
“involved” in misconduct that would be reportable under | activities. Matters relating to employees who assisted during the 
question 1 of the MRC Information Template, as an individual | investigation process but did not take part in the misconduct 
may simply be a member of the management team when the Al | himself/herself are not required to be reported. 
committed a regulatory breach, or he/she may be interviewed 
as part of a wider investigation but did not commit the | The IWG is invited to develop more detailed and practical instructions 
misconduct. together with examples on what constitutes reportable information 

for reference by the industry. 

17. | Materiality Threshold The HKMA is of the view that quantifiable threshold of severity may 





Some respondents considered that defining a materiality 
threshold for reportable misconduct would be useful, such that 
reportable misconduct would be confined to those of serious 
nature. One respondent suggested to attach an amount 
threshold (e.g. beyond a HKD amount threshold in a fraud case). 
One respondent proposed to only provide records of 
misconduct which led to a dismissal. 





not be applicable in all circumstances, given that the operational 
scale of Als varies, and that the monetary sum might not fully reflect 
the circumstances and severity of the misconduct incident. The 
inclusion of only the records of misconduct which led to a dismissal 
is also insufficient. Nonetheless, the HKMA agrees that reportable 
information should be confined to that which is material or serious in 
nature and should generally fall under categories (i) to (v) as stated 
in paragraph 35 in the Consultation Paper. Als should exercise 
judgement in considering the severity of the misconduct incidents. 
More practical guidance together with examples on what constitutes 
reportable information can be further deliberated by the IWG. 
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Comments / questions from respondents 
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18. 


Incidents related to honesty, integrity or matters of similar 
nature 

One respondent considered the coverage of the said category 
too vague. It is unclear if internal investigations which do not 
result in adverse findings constitute a reportable incident. It 
was suggested that this category be made more specific, such as 
for example “Incidents which cast serious doubts on honesty, 
integrity or matters of similar nature”. 


The HKMA agrees to refine the said category as "Incidents which cast 
serious doubts on honesty, integrity or matters of similar nature”. 
Internal investigations which do not result in adverse findings should 
not constitute reportable information. 





19. 


Misconduct report filed with the HKMA 

One respondent sought clarification on what constitutes a 
misconduct report filed with the HKMA, for instance whether it 
is one that is addressed specifically to the HKMA only or 
whether it includes correspondence addressed to other relevant 
authorities and copied to the HKMA. One respondent also 
sought clarification on whether reports filed with or copied to 
the HKMA with undetermined/inconclusive results would also 
fall within the reporting scope. 


Misconduct reports filed with the HKMA should cover those filed 
against the individual regardless of whether the report is filed 
specifically with the HKMA only or with other relevant authorities 
and copied to the HKMA. 


Reports with undetermined / inconclusive results filed with the 
HKMA may still cast doubts on the honesty and integrity of the 
individuals. The HKMA invites the IWG to consider how reference 
providing Als should exercise judgement in considering whether such 
reports would fall within the reporting scope. 





20. 


Sexual harassment/bullying 

One respondent asked whether sexual harassment or bullying 
should fall under conduct matters and be reportable under the 
MRC Scheme. 


Sexual harassment or bullying should be considered misconduct 
activities and should be included as reportable matters under the 
scope of MRC. 








21. 





Scope of "any other information" 
In relation to question 2 of the MRC Information Template, one 





The reference providing Al is expected to provide any other 
information that it reasonably considered to be relevant to recruiting 
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respondent sought clarification on what constitutes “any other 
information” that is relevant to the fit and proper assessment of 
an individual. 


Al’s assessment of whether the individual is fit and proper. The 
disclosure should be made on the basis that the reference providing 
Al should only disclose information about incidents or matters that: 
(1) occurred or existed 
(a) within the specified period before date of request for a 
reference; or 
(b) between the date of request for the reference and the date 
the reference providing Al provides the reference; and 
(2) is related to misconduct that is of a material or serious nature. 





22. 


Reference providing Als to pass on previously obtained MRC 
information 

One respondent suggested that the recruiting Al may only need 
to obtain MRC information from the reference providing Al 
which last employed the individual, which would not only 
provide the recruiting Al with the individual’s MRC information 
during his/her period of employment, but also all previous MRC 
information obtained by that reference providing Al from 
previous employers of the individual. 


We consider “recycling” of MRC information previously obtained 
from other Als neither adequate nor appropriate as there may be 
subsequent MRC information updates that may not be made known 
to the Al which last employed the individual. There may also be 
personal data privacy concerns regarding the transfer of such MRC 
information. Recruiting Als should therefore directly reach out to 
current/former employers of the individual concerned with the MRC 
request. 


For reference providing Als, the scope of information to be provided 
should be confined to the individual’s activities during his/her period 
of employment, and reference providing Als are not obliged to pass 
on MRC information that they previously obtained from the 
individual’s former employers. 








23. 





Question 2 in the MRC Information Template 
One respondent considered “fit and proper” can be interpreted 





Given the interpretation of “fit and proper” may have a broader and 
slightly varying meaning in different regulatory regimes, question 2 is 
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very broadly and that the term is used in different regulatory 
regimes which may have a wider meaning than that is intended 
under the MRC Scheme. 


proposed to be revised as follows: “Are you aware of any other 
information that you consider would be relevant to our assessment 
on the conduct of the individual?” 





24. 


Confidentiality obligations 

Some respondents noted that an Al which has entered into a 
deed of release with a departing employee will often be bound 
by confidentiality provisions in the deed, and will not be able to 
disclose information regarding the employment of the 
employee. 


After implementation of MRC, Als should be mindful about entering 
into any contractual obligations which may limit their ability to 
disclose information as required under the MRC Scheme. Also, the 
written consent of the individual should be formulated to be 
provided to both recruiting and reference providing Als to exclude 
them from contractual obligations which may limit their ability to 
disclose information as required under the MRC Scheme. 


For contracts that have already been entered into, Als should seek to 
review the contractual arrangements to address any contractual 
obligations which may limit their ability to disclose information as 
required under the MRC Scheme. The HKMA invites the IWG to 
explore ways to address situations where further limitations would 
be experienced. 





25. 


Disclosure of confidential and proprietary information to 
competitor Als and the public 

Some respondents noted that the disclosure of misconduct 
activities may unveil proprietary information, internal control 
deficiencies or business secrets of the reference providing Als. 


Reportable information should focus on the misconduct activities of 
the individual concerned rather than details of proprietary or 
sensitive commercial information of the Al concerned. 








26. 





SFC notification requirements also applies to registered 
institutions (“RI”) 





For Als which are Rls under the SFO, they are required to report to 
the HKMA and the SFC any investigation conducted on an EO within 
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One respondent noted that the proposed scope of MRC 
information is too broad and is inconsistent with the approach 
taken by Securities and Future Commission (“SFC”) which only 
requires licensed corporations (“LCs”) to provide the SFC with 
information about whether a licensed individual who ceases to 
be accredited to it was under any investigation commenced by 
the LC within six months preceding his/her cessation of 
accreditation. The respondent suggested for the HKMA to take 
into account the SFC’s notification requirements and approach 
with respect to investigations, and ensure a consistent standard 
is applied across the financial industry. 


6 months preceding the cessation of appointment of that individual 
as an EO. Such a requirement has been communicated in the HKMA 
circular dated 31 May 2019. 


The MRC Scheme is currently proposed to be applied to Als and not 
to the broader financial sector outside of banking, and any expansion 
of the application of the MRC Scheme will be subject to discussion 
with other relevant stakeholders. 








27. 





Definition of investigations 
One respondent sought clarification on what constitutes 
“investigations”. 





The following is a non-exhaustive list of examples of investigations: 

- investigations about suspected breach or breach of applicable 
laws, rules and regulations; 

- investigations about suspected breach or breach of the Al’s 
internal policies or procedures; 

- investigations about misconduct that are likely to give rise to 
concerns about the fitness and propriety of the individual; 

- investigations about any matter that may have an adverse 
market or client impact; and 

- investigations about any matter potentially involving fraud, 
dishonesty and misfeasance. 


The HKMA invites the IWG to provide more guidance as necessary. 
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28. 


Investigations which commenced after departure of individual 
The Consultation Paper proposes that where an investigation or 
proceeding concerning the individual is commenced after the 
individual has left the reference providing Al, the reference 
providing Al should update the recruiting Al if the investigation 
is commenced within 10 years after the individual’s departure. 
One respondent considered that there may be potential 
unfairness to the individual if an investigation is only initiated 
and reported after such a substantial period of time following 
the individual’s departure. 


The 10-year period was proposed on the ground that some financial 
products such as insurance products are of a relatively longer term 
nature, and that misconduct issues such as mis-selling may not 
surface until a relatively long time has lapsed. That said, taking into 
account industry comments, it is proposed that the reference 
providing Al should consider providing an update to the recruiting Al 
(which to their best knowledge is the current employer of the 
individual) on an investigation that is commenced within 7 years 
instead of 10 years after the individual has left the reference 
providing Al. This is also in line with the proposed duration of MRC 
information as stipulated in #48. See also #12 on the disclosure and 
the provision of updates related to ongoing investigations. 


Detailed operational arrangement can be further deliberated by the 
IWG. 





29. 


Level of detail 
One respondent sought clarification on the level of detail 
required in the MRC Information Template. 


A reference should provide a factual description of the incidents, the 
outcome of any investigation and the disciplinary action, if 
applicable. Disclosures are not normally expected to include 
proprietary or commercially sensitive information. 








30. 





Supporting documents 

Some respondents sought clarification on whether the 
reference providing Als are required to provide additional 
supporting documents on top of the written information as 
specified in the template. 





The reference provided to the recruiting Al should be clear and 
factual description of the matters. The reference providing Al is not 
expected to provide internal supporting documents to the recruiting 
Al. However, the referencing providing Al should retain such internal 
documents for audit trail purposes. 
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Q5. Do you have any comments on the proposed scope of reportabl 
MRC Scheme? 


e internal and external disciplinary actions to be covered under the 














31. | Reduction in remuneration arising from matters other than | Reduction in remuneration as a result of the performance of the 
misconduct individual, economic conditions, or a change in role or 
One respondent sought clarification on whether remuneration | responsibilities that does not relate to the individual’s conduct 
reductions arising from factors such as the unsatisfactory | matters would generally not be regarded as reportable items under 
performance of the individual, economic conditions, or a | the MRC Scheme. 
change in his/her role or responsibilities would be counted as a 
reportable item under the MRC Scheme. 

32. | Definition of claw-back of remuneration For simplicity, it is proposed to generalise the term as financial 
Some respondents sought clarification on the definition of claw- | penalty involving remuneration that arises from misconduct of the 
back of remuneration. individual. 

33. | Internal disciplinary actions The definition of internal disciplinary actions may vary among 


Some respondents sought clarification on whether suspensions 
pending investigations, verbal warnings, leaves taken while 
carrying out an investigation, managerial coaching or 
counselling would be considered as part of the internal 
disciplinary actions that are reportable under MRC. One 
respondent also sought further guidance and practical examples 
of what would be considered to fall outside the scope of 
“internal disciplinary actions”. 





different Als. For the purpose of the MRC Scheme, internal 
disciplinary actions should include actions that are taken by the Al 
against the employee as a result of misconduct on the part of the 
employee. Generally speaking, internal disciplinary actions may 
include internal warnings (either in verbal or written form); financial 
penalties involving remuneration; and suspensions and dismissals as 
a result of misconduct. 


For the purpose of MRC Scheme, internal disciplinary actions are not 
expected to include managerial coaching and counselling, 
suspensions pending investigations, or leaves taken while 





investigations are being carried out. Reportable internal disciplinary 
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actions should be those that arise from misconduct of material 
nature. Als should exercise judgement in considering whether an 
internal disciplinary action should fall within the reporting scope. 


The IWG can provide practical examples to illustrate what constitutes 
internal disciplinary actions based on the principles described above. 





34. 


External disciplinary actions 

Some respondents noted that the reference providing Al may 
not have full knowledge about external disciplinary actions as 
such information may not be publicly available. 


External disciplinary actions refer to those taken by regulatory 
bodies, industry associations and professional bodies against the 
individual during his/her employment with the reference providing 
Al. The expectation of the HKMA is that reference providing Als will 
report external disciplinary actions that are known to the public ona 
best endeavour basis. Reference providing Als are not obliged to 
conduct a search on behalf of the recruiting Al for actions taken 
against the individual outside of their employment period. 








35. 





Removal of internal disciplinary actions 

One respondent suggested removal of “internal disciplinary 
actions” from the scope of MRC information, or that it should 
be confined to internal disciplinary actions which arise from 
significant breaches. 





Internal disciplinary actions may stem from a breach of an Al’s 
internal policies and procedures and would be considered conduct 
matters, and hence they should not be removed from the scope of 
MRC information altogether. Reference providing Als are expected 
to exercise judgement and consider the substance of the matter to 
decide whether to report the item under the MRC. See #33 on 
internal disciplinary actions under the MRC Scheme. 


We agree to limit the scope to internal disciplinary actions which 
arise from breaches which are of a material or serious conduct 
nature. See #17 on materiality threshold. 
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36. 


Grace period 

One respondent suggested a grace period should be provided in 
the first few years of MRC implementation as Als generally have 
different data retention policies that may fall short of the 
retention period that is required under the MRC. 


Upon finalisation of the details of the MRC Scheme, Als are expected 
to establish policies and procedures to retain and start building MRC 
records on an ongoing basis. For reference providing Als, where MRC 
records may not have been retained prior to introduction of the MRC 
Scheme, they should provide relevant information to the recruiting 
Al on a best-effort basis. 


The IWG may work out suitable transitional arrangements for Als 
which may not have retained records for a 7-year period upon the 
implementation of the MRC Scheme. 





Q6. Do you have any comments on the proposed MRC Information Template in Annex 2 to this paper? 











37. | Definitions of terms used in the MRC Scheme While the Consultation Paper and Conclusions Paper have elaborated 
Some respondents requested for definitions of the various | HKMA’s view on key matters on the MRC Scheme, it is suggested that 
terms used in the MRC Information Template, to avoid | the |WG may consider formulating a list of abbreviations / definitions 
ambiguity in implementing this template in practice. for the implementation of the MRC Scheme. 

38. | Textual suggestions on template The proposed textual amendments are considered acceptable. 





One respondent proposed some textual changes to the first 
paragraph of the template: 

e In the proposed template, the recruiting Al is required to 
provide the two dates covering the period it is seeking 
information for. This seems unnecessary and the first 
paragraph is suggested to be revised to read: “The 
information should cover any period falling within 10 years 
prior to the date of this request where the following 
individual is employed by your institution.” 


Further refinements can be considered by the IWG. 
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e The first sentence is suggested to be amended to read “We 
have made a conditional offer of employment to the 
following individual...”. 





39. 


Job specifications 

Respondents sought clarification on the level of detail required 
on the “description of role” column in the table “Information of 
employment record”. One respondent considered that job 
specifications are usually detailed and descriptive information 
which may not be held centrally in the HR department and may 
not be particularly useful in assisting Als to halt “rolling bad 
apples”. One respondent noted that some Als’ human 
resources systems generally capture only an individual’s title 
and department, such that requiring validation on the content 
on every job position would be administratively burdensome. 


To simplify the efforts required and at the same time reflect the job 
nature of the positions, the “description of role” column will be 
replaced by “name of business/function” together with an additional 
column “department” in the table. The information is for 
identification purpose and it is not expected that detailed job 
specifications would be provided here. 





40. 


Allegations without detrimental findings 

One respondent sought clarification on whether “involvement” 
in an internal/external disciplinary action is intended to capture 
an investigation where allegations were made against the 
candidate but no detrimental findings were substantiated 
against them. 


Generally speaking, allegations without substantive findings or those 
where the investigations are inconclusive are not required to be 
reported in the MRC template. See #12 for further elaboration on 
disclosure and provision of updates related to ongoing investigation 
and #19 for further comments on misconduct reports with 
undetermined / inconclusive result. 








41. 





Enclosure of employee consent 

Respondents sought clarification on whether the enclosure of 
employee consent is required when initiating MRC request to 
reference providing Al. One respondent indicated preference to 





To reduce the administrative burden on the recruiting Al, the IWG 
may consider whether the consent form should be enclosed with the 
MRC request, or alternatively, if a standard clause can be included in 
the MRC request indicating that consent from the employee has been 
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# Comments / questions from respondents HKMA’s response 
have the consent form attached to the MRC request, while | obtained. The standard clause can be prescribed by the IWG. 
acknowledging that attaching the consent will also create a 
burden for recruiting Als. 
42. | Disclaimer in the MRC request / Indemnification scheme / safe | The IWG can discuss and formulate the appropriate ways for Als to 





harbour provisions 

One respondent suggested that consideration be given to 
requiring the recruiting Als to indemnify reference providing Als 
against any legal action brought by employees which result from 
negative information disclosed by the reference providing Al in 
good faith and in accordance with the MRC Scheme. It was 
suggested that an industry consistent disclaimer could be 
included in the template which provides: 

(a) the information provided is true, complete and accurate 
according to the reference providing Al’s best knowledge; and 
(b) the recruiting Al takes full responsibility in relying on the 
information provided in the Template in making its recruitment 
decision, and the reference providing Als is excluded from 
liability in the absence of negligence and bad faith. 


One respondent also noted that as recruiting Als are responsible 
for obtaining written consent from prospective employees to 
exempt/waive reference providing Als from contractual 
obligations which may limit their ability to disclose information 
regarding the prospective employee (such as confidentiality 
obligations under exit agreements), i.e. the agreement is 
between the prospective employee and the recruiting Al, the 


delineate responsibility and mitigate potential litigation risks under 
the MRC Scheme. 
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reference providing Al may not be able to benefit from the 
waiver and be released from contractual liabilities. 


One respondent also suggested that “safe harbour provisions” 
be set up alongside the proposed MRC Scheme to safeguard the 
legal interests of Als. 





43. 


Modification of MRC template 

Some respondents asked if the format of the MRC template can 
be modified. One respondent suggested to have two versions 
of the MRC template, one for simple cases with “clean” 
individuals and one for cases with reportable items. 


The IWG may refine the format of the MRC template to better suit 
the needs of the industry, and consider whether two versions of 
template would be more preferable. 





44. 


Right to request MRC copy 

Some respondents sought clarification on whether the 
prospective employee would have the right to request for a copy 
of his/her MRC information from the recruiting Al and/or the 
respective reference providing Als. It seems unfair to the 
individuals if they have no opportunity to dispute the 
information provided. 


Prospective employees should be given the right to request for a copy 
of their MRC information. This is in line with Data Protection 
Principle 6 and section 22 of the PDPO, and in particular in the event 
that the prospective employee is given negative comment, such that 
the prospective employee is given the right to request a correction of 
inaccurate personal data under the PDPO. In general, all Als should 
implement measures and have policies and procedures in place to 
ensure that they can comply with a data correction request made by 
a job applicant, current or former employee. 








45. 





Multiple roles served in the reference providing Al 

One respondent sought clarification on whether multiple roles 
that the individual served in the reference providing Al should 
all be covered in the MRC template or only the last position is 





The template should cover all positions held by the individual at the 
reference providing Al that fall within the specified period and not 
only the last position. 
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necessary. One respondent questioned whether the “Reason 
for the cessation of appointment” column is only applicable to 
the last position held by the individual within the Al, if the 
individual has held multiple positions in the same Al during the 
applicable period. 


“Reason for the cessation of appointment” will only apply to the last 
position held by the individual within the Al if the individual has held 
multiple back-to-back positions in the same Al during the 
employment period. 





46. 


Suggested amendments to Question 1 

One respondent suggested that for consistency, the latter part 
of Question 1 (where descriptions of details are to be provided) 
should be answered in table format, with the following columns 
to be included in the table: 

(a) background of the matter; 

(b) the date(s) when the matter occurred; 

(c) the duration of the matter; 

(d) the role played by the outgoing employee; 

(e) the (potential) impact to the market and clients; 

(f) assessment of materiality; 

(g) the status of the investigation; and 

(h) the outcome of the investigation and the basis of conclusion, 
if the investigation is completed. 


The proposed amendments are broadly acceptable. Further 


refinements on the template can be discussed in the IWG. 








47. 





Consolidation with foreign reference check standard forms 
One respondent suggested consolidating all information to be 
acquired or supplied under different MRC regimes into a single 
template. 





As the application of the MRC Scheme is confined to the Hong Kong 
banking industry at the initial stage, it may not be necessary to have 
a consolidated template of the different regimes. 
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Q7. Do you have any comments on the proposed duration of MRC information coverage, i.e. 10 years of employment records? 


Q8. Do you foresee any difficulties for Als to maintain 10 years of em 


ployment records of their employees for MRC purpose? 





48. | Duration of MRC information 

Respondents generally considered that for MRC information to 
cover 10 years of employment records to be burdensome and 
unduly long as the traditional practice of employment record 
retention is for 7 years. They noted that the PDPO 
recommendation is to hold employment related data for no 
longer than 7 years from the date the employee leaves 
employment, unless express consent is provided by the 
employee or that there is a subsisting reason to retain the data 
for a longer period of time. Respondents noted both 
operational and resources concerns in retaining employment 
related data for more than 7 years. A longer period may also 
deny employees a rehabilitation opportunity. 


This proposal of 10 years was made with reference to the current 
HKMA requirement for individuals to disclose 10 years of 
employment records in their applications for the positions of 
directors, CEs, ACEs and EOs at Als. The PCPD noted that as the MRC 
Scheme is conducted for the legitimate purposes of tackling the RBA 
issue and enhancing integrity of the banking industry, there are 
subsisting reasons for Als to retain MRC-related employment data for 
longer than the 7-year retention period applicable otherwise. 


The HKMA has duly considered the industry’s comments and is of the 
view that the employment records retention period can be reduced 
to 7 years for Phase 1 and Phase 2 of the MRC Scheme, subject to 
further deliberation of the IWG. 





Q9. Do you have any comments on the requirements to obtain conse 


nt from the prospective employee? 











49. | Refusal to provide consent While the employment decision is made by the recruiting Al at their 
Some respondents asked whether an Al can proceed with | discretion, the recruiting Al should consider the reasons behind the 
employment if a prospective employee refuses to provide | refusal to provide consent and whether it casts doubt on the fitness 
consent to the MRC process. and propriety of the individual. In cases where the recruiting Al 

decides to proceed with employment without conducting MRC, the 
justifications for such exemption should be documented. 

50. | Industry consent template for MRC The IWG is invited to take the lead to develop a standard consent 


Most of the respondents considered that having a standard 
written consent template for MRC would be beneficial so that a 





template and exploring ways for conducting the MRC Scheme 





electronically. 
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# Comments / questions from respondents HKMA’s response 
consistent approach can be adopted across the industry. One 
respondent suggested to take into account the Electronic 
Transactions Ordinance and cater for situations where Als prefer 
to conduct the MRC Scheme reporting in a paperless way. 

51. | Withdrawal of consent In cases where a prospective employee subsequently withdraws their 
One respondent proposed that procedures should be | consent, the recruiting Al should inform the reference providing Al as 
incorporated to provide for situations where a prospective | soon as practicable, so that the reference providing Al would cease 
employee subsequently withdraws their consent. One | to provide MRC information. We welcome the IWG to work out a 
respondent suggested having a standardised notification | standardised notification template which recruiting Als could use to 
template which recruiting Als could use to notify reference | notify reference providing Als of the withdrawal of consent. 
providing Als of the withdrawal and the relevant procedures. 

52. | Making MRC requests to current employers A possible way to address the concern is for the recruiting Al to 





Some respondents considered that recruiting Als may face 
practical difficulties in obtaining the prospective employee’s 
consent to request MRC information from his/her current 
employer as this would inevitably expose the prospective 
employee’s intention to change job which in turn may affect the 
current employment relationship if the prospective employee 
eventually cannot secure a job offer from the recruiting Al, 
which is a particularly sensitive issue for senior management 
staff. Without a secure job offer from the recruiting Al, it is 
understandable that the prospective employee would be 
reluctant to give consent as it would affect the existing 
employment relationship. One respondent suggested 
permitting the prospective employee to join the new bank while 





consult and coordinate with the prospective employee on the 
appropriate timing for sending out MRC requests. For example, the 
recruiting Al may first seek MRC information from the prospective 
employee’s former employers, to be followed by the prospective 
employee’s current employer at a later stage, say after he/she has 
tendered his/her resignation. An illustrative sequence is outlined 
below: 

(a) Step 1: Extend an employment offer to the candidate, if 
applicable, conditioned upon the recruiting Al receiving satisfactory 
MRC information from his/her existing and former employers; 

(b) Step 2: Obtain the candidate's consent and request MRC 
information from his/her former employers; 

(c) Step 3: After the candidate has tendered his/her resignation, or 
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the last employer verification is pending. 


after the candidate’s last day with his/her current employer, a MRC 
request can be sent to the current employer; and 

(d) Step 4: After MRC information has been received from the current 
employer and upon completion of assessment by the recruiting Al, a 
final offer can be issued. 


The operational details can be discussed and refined by the IWG. 


To minimise possible disputes and the possibility of rescinding an 
offer for employment, all Als are strongly encouraged to complete all 
the MRC processes before on-boarding the prospective employee 
such that Als can make an informed decision of employment with 
reference to information provided by the reference providing Al(s). 








53. 





Finalisation of employment decision 

Some respondents asked whether recruiting Als are required to 
complete all the MRC processes before making employment 
decisions, and whether there would be any legal and/or 
regulatory consequences if the recruiting Al chooses to hire an 
individual despite being informed about misconduct in the 
individual’s employment history. Some sought guidance on the 
types of considerations and factors which the HKMA would 
deem sufficient to justify a recruitment decision. 





Recruiting Als are strongly encouraged to complete all the MRC 
processes before on-boarding prospective employees. In cases 
where a recruiting Al would like to advance the employment decision 
before the completion of the MRC process, it may consider making a 
conditional offer, or requiring the prospective employee to provide a 
self-declaration that he/she has not been involved in any misconduct 
incidents or subject to any material disciplinary actions, while 
pending the completion of the MRC processes. 


As mentioned in paragraph 46 of the Consultation Paper, the 
recruiting Al will have full discretion in making any employment 
decision. The factors to be taken into consideration when exercising 
discretion include, among others, the competencies of the individual, 
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# Comments / questions from respondents HKMA’s response 

relevant regulatory requirements, and for those prospective 
employees with negative MRC information, the likelihood of the 
prospective employee committing misconduct again in the new 
working environment. It should be noted that the recruiting Al will 
be ultimately responsible for such a decision, notwithstanding that 
appointment to some senior positions may also require regulatory 
approvals. 

Q10. Do you foresee any practical issues in reaching out to existing and former employer Als of the prospective employee in the past 10 

years? 

54. | Completeness of employment records The recruiting Al should exercise judgement and make enquiry on the 
Some respondents asked whether recruiting Als are expected to | employment gaps of prospective employees where appropriate. 
verify details of any “gaps” in prospective employees’ | Recruiting Als may also require prospective employees to declare 
employment history, and whether recruiting Als will be held | their employment records provided are true and complete. 
liable for failing to obtain MRC records for any positions 
previously held by prospective employees that should be 
disclosed by the prospective employees during their application 
process. 

55. | Merger and acquisition / dissolvation / revocation / | For Als that are merged, acquired by other firms, or restructured, 
restructuring of Al etc., the recruiting Al should conduct MRC with them as far as 
Some respondents considered there would be difficulties in | practical and feasible. For Als that have been dissolved, or whose 
obtaining MRC information from Als that have been merged or | banking licenses have been revoked, recruiting Als are not required 
acquired by other firms, dissolved or restructured, or whose | to obtain MRC information from them as the contact channel may no 
banking licenses have been revoked. longer be available. 

However, Als are reminded under some circumstances regulatory 
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approval will be required under section 73 of the BO for employment 
of bank staff who have served in certain positions of institutions that 
had been dissolved or whose license had been revoked. 





Q11. 


Do you foresee any practical issues in providing an opportunity 


to be heard to the prospective employee? 





56. 


Opportunity to be heard 

Most of the respondents considered that Als should not be 
obliged to provide an opportunity to be heard to the prospective 
employee in all circumstances on the grounds of possible tipping 
off; quality of on-going investigation being compromised; and 
potential breach of secrecy obligations, etc. 


Some suggested that the right to be heard could be limited to 
internal investigations only, and exclude disciplinary actions 
taken by regulators. Respondents generally expressed concerns 
about Als facing potential liability claims and litigation risks 
arising from defamation. 


One respondent also sought clarification on how the recruiting 
Al should handle situations where there are contradictions 
between the information provided by the prospective employee 
and that by the reference providing Al. 


Having considered the industry’s comments, the HKMA maintains the 
view that on the ground of fairness to the prospective employee, an 
opportunity to be heard should generally be provided, including but 
not limited to cases where the misconduct incident has been 
substantiated, or where external or internal disciplinary actions have 
been taken against the individual. As for cases where there are legal 
impediments for disclosure to the prospective employee in the 
course of providing an opportunity to be heard (such as alleged 
misconduct cases that are still under confidential investigation, cases 
involving sensitivity concerning secrecy or potential tipping off, and 
cases with other potential legal implications, etc.), it would be 
appropriate for the proposed IWG to consider the practical issues in 
more detail taking into account PCPD’s views. 


In cases where there are contradictions between the information 
provided by the prospective employee and that by the reference 
providing Al, the recruiting Al should assess the credibility of the 
information provided and whether it casts doubts on the honesty and 
integrity of the prospective employee in making the hiring decision. 








57. 





Duty to investigate 
Some respondents considered that provision of opportunity to 


The provision of opportunity to be heard is a due process aiming to 





ensure fairness and safeguard the interest of the prospective 
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be heard will impose additional obligation on the recruiting Al 
to further investigate if new facts are provided by the candidate 
which are beyond or in conflict with those included in the MRC 
Information Template, and this may increase the burden for 
both the recruiting and reference providing Als. 


employee. It does not necessitate a duty for either the recruiting Al 
or the reference providing Al to re-open an investigation as it will be 
up to the recruiting Al to make an employment decision taking into 
account the MRC information provided by the reference providing Al 
and any comments expressed by the prospective employee 
concerned. 





Q12. 


Do you have any other comments in relation to the obligations of recruiting Als under the MRC Scheme? 





58. 


Information sharing within Al’s group 

One respondent sought clarification on how the MRC 
information could be shared with other entities within the Al’s 
group (e.g. affiliates) and used in relation to matters such as an 
affiliate’s decision on whether to hire a particular employee. 


Als are advised to seek their own legal advice on the potential 
implications of sharing MRC information within the group to ensure 
such use of MRC information will not contravene any relevant laws 
and regulations. 








59. 





Extent of follow-up actions by recruiting Al 

One respondent sought clarification on the extent of follow-up 
actions required of the recruiting Al after receiving MRC 
information from reference providing Al, and whether the 
recruiting Al is deemed to have discharged its obligation if the 
reference providing Al refuses to provide further details on the 
grounds of confidentiality (e.g. proprietary business and 
employees information, weaknesses in internal operations, 
etc.). 


Recruiting Als are deemed to have discharged their obligations if the 
reference providing Al did not provide a response within the specified 
period of one month or a longer period mutually agreed by both 
parties. Reference providing Als should make the effort to provide 
an interim reply if they need more time to provide the requested 
follow-up information. 


Generally speaking, reference providing Als should respond to follow- 
up questions to facilitate the recruiting Al’s reference checking 
processes as far as practicable. However, there may be 
circumstances under which a reference providing Al may refuse to 
provide further information as doing so may reveal confidential and 
proprietary information about their business and employees (other 
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# Comments / questions from respondents HKMA’s response 
than the employee seeking employment with the recruiting Al), as 
well as other commercially sensitive information which may be 
irrelevant for the MRC purposes. See also #29. 

60. | Retention period of MRC information The duration of the retention period of MRC information received by 
One respondent sought clarification on the retention period | the recruiting Al should follow its practices on the retention of other 
required of MRC information obtained from reference recruiting | employment or recruitment records. 

Als. 

61. | Outsourcing Als may outsource their MRC process to external services providers 
One respondent sought clarification on whether Als can |as long as the Als remain ultimately responsible for ensuring 
outsource the MRC process to external services providers to | compliance with the relevant supervisory requirements applicable to 
assist them with the process subject to the Als complying with | outsourcing. In particular, Als should have contractual arrangements 
applicable regulatory requirements. and relevant controls in place to safeguard the security and storage 

of data to prevent data leakage if outsourcing is adopted. 

62. | Delay in provision of feedback from the reference providing Al | As mentioned in paragraphs 50 and 51 of the Consultation Paper, 





One respondent sought clarification on situations where a 
reference providing Al fails to provide a response on a MRC 
request within the specified period, and suggested to establish 
a reporting channel in the event a reference providing Al fails to 
reply within the specified period. One respondent sought 
clarification on whether any potential penalty or disciplinary 
action would be inflicted on reference providing Als if there is a 
delay in responding to the MRC request. 





reference providing Als should normally respond within the specified 
period. However, if they encounter difficulties which render them 
unlikely to be able to observe the specified period of one month, they 
should at least provide an interim reply to the recruiting Al on the 
reasons why they could not respond to the request in time, together 
with an estimated timeframe for when a response can be made. The 
recruiting Al would be considered to have discharged its obligation 
under the MRC Scheme if it does not receive any MRC information or 
interim reply from the reference providing Als after the specified 
period of one month or a longer period mutually agreed by both 
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parties. 


In cases where Als observe repeated failures of a particular Al to 
respond to MRC requests, such a matter can be raised to the IWG for 
discussion and any unresolved matter can be brought to the 
attention of the HKMA through the IWG. Repeated failures may 
indicate potential weaknesses on the governance arrangements as 
well as the internal controls and procedures of the Al, and the HKMA 
may follow up with the Al concerned accordingly. 





63. 


Contact points at Als for the MRC Scheme 
Some respondents asked about ways to ensure timeliness in 
receiving MRC information. 


We expect the IWG to work out a contact list to facilitate the 
operation of the MRC Scheme, such that enquiries can be made 
promptly, via email or other means. As set out in paragraph 58 of the 
Consultation Paper, going forward, the industry is encouraged to 
consider developing application programming interface (API) based 
application or other advanced technology such as blockchain based 
solution for exchange and maintenance of MRC information. 








64. 





Negative MRC information received after the employee is 
onboard 

One respondent asked if the recruiting Al receives subsequent 
negative MRC updates concerning a candidate who is already on 
board the recruiting Al, whether the recruiting Al is obliged or 
expected to re-assess the fitness and propriety and possible 
termination of the employment. 





Als will have the discretion to decide whether to rescind an offer for 
employment or to continue to proceed with the employment upon 
receipt of negative MRC information after on-boarding of the 
employee. If Als choose to continue with the employment 
notwithstanding the negative information, Als should document the 
justifications and should take such negative MRC information as a red 
flag that may warrant a greater scrutiny on possible conduct risks that 
may be posed by such individuals. Depending on the nature and 
severity of the information, this should inform Als of possible 
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mitigating measures. 





65. 


Data breach 

One respondent sought clarification on the notification 
requirements on the recruiting Al if there is a data breach of 
MRC information at the recruiting Al, such as whether it is 
necessary to inform the reference providing Al of such a breach. 


In general, Als should comply with the relevant laws and regulations 
in relation to data security. Als should seek legal advice on the 
potential implications of a data breach. 





Q13. 


Do you have any comments on the requirement for the reference providing Als to respond to MRC requests within 10 working days? 





66. 


Length of time to respond to MRC request 

Most of the respondents considered that 10 working days would 
not be sufficient for a reference providing Al to respond to the 
MRC request, as some Als may have lean HR department setup 
where handling of staff records may involve other functional 
department within the Al. Some respondents considered 
imposing the MRC Scheme would cause a delay in the hiring 
processes. 


To avoid undue delay to the hiring process, it is important and 
necessary to strike a balance between Als’ operational needs and 
efficiency in handling MRC requests. Taking into account industry 
concerns, the response time had been lengthened to one month. To 
facilitate timely receipt of MRC requests, the HKMA encourages the 
industry to set up and maintain a list of contact points of individual 
banks for the purpose of MRC process to facilitate efficient 
communication and information exchange among Als. Refinements 
to the response time can be considered by the IWG having regard to 
industry feedback and operational experience. 





Q14. 


Do you have any comments on the requirements for reference 


providing Als to provide updated MRC information to recruiting Al? 








67. 





Corporation in the process of applying banking licence 

One respondent considered that Als should not be required to 
respond to MRC request made by a corporation that is still in the 
process of applying for a banking licence. 


Corporations in the process of applying for a banking licence does not 
fall within the scope of MRC and thus reference providing Als are not 
obliged to provide reference information to such corporations. After 
a corporation has obtained a banking licence, they may consider 
conducting MRC on its in-scope personnel. 
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68. 


Providing update on MRC information 

Some respondents considered burdensome for reference 
providing Al to verify the employment status of former 
employees with recruiting Als, especially those of jumpier 
employees, before providing an update on MRC information. 
One respondent suggested the IWG to develop standard 
templates for the notification procedures to ensure efficiency 
and reduces the administrative burden of Als. 


To alleviate the operational burden on the reference providing Al and 
to facilitate follow-up by the recruiting Al, it is suggested that, when 
responding to the MRC request, reference providing Als may also 
indicate whether they expect an update to be provided later on, with 
an approximate indication on the time when such an update is 
expected. The recruiting Al can then let the reference providing Al 
know if the prospective employee has been on-board and further 
approach the reference providing Al for update if needed. If the 
prospective employee leaves the recruiting Al before any updated 
MRC information is provided, then the recruiting Al should inform the 
reference providing Al so that no further MRC information will be 
provided to the recruiting Al. In cases where the recruiting Al 
receives an update from reference providing Als on individuals who 
no longer work in the recruiting Al, they should notify the reference 
providing Al of such but do not have an obligation to identify the 
current employer of the individual. 


The IWG may refine the notification procedures and develop relevant 
standard templates. The application of these arrangements can be 
revisited and refined having regard to operational experience during 
the Phase 1 review. 








69. 





Scenarios which warrant an MRC update 

Some respondents sought clarifications on the types of 
scenarios which warrant the provision of an update by the 
reference providing Al. Respondents considered that where a 
reference providing Al has notified the recruiting Al of an 





An MRC update should be provided by reference providing Als if it 
may lead to substantive changes to the reference information 
previously provided. In determining whether an update is necessary, 
the reference providing Al should consider factors including the role 
of the former employee in the misconduct, and the seriousness of 
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ongoing investigation into an individual and that the | the incident, etc. 
investigation subsequently concludes that the individual has not 
committed misconduct, the reference providing Al should notify 
the recruiting Al of this fact. Respondents also sought 
clarification on whether it is necessary to provide an update if 
the individual is not the subject of an investigation. 

70. | Liability on failure to update For misconduct that is recently discovered or falls within the scope of 
One respondent sought clarification on situations where a | reportable information due to a change in laws and regulations, 
misconduct is recently discovered or falls within the scope of | reference providing Als should consider the factors indicated in #68 
reportable information due to a change in laws and regulations, | in determining whether it is necessary to provide an update. Since 
whether reference providing Als are required to provide an | the MRC Scheme is intended to be an industry-led initiative instead 
update and if they are subject to any liability if they fail to do so. | of a supervisory requirement, Als are encouraged to comply with the 

requirements stipulated in the MRC Scheme to ensure its 
effectiveness. 

Q15. Do you have any other comments in relation to the obligations of reference providing Als under the MRC Scheme? 

71. | Work performance The MRC Scheme focuses on the conduct aspect of prospective 
One respondent sought clarification on whether it is required to | employee. Work performance that is non-conduct related would not 
disclose an individual’s work performance under the MRC | fall within the context of “bad apple” and thus will not be required to 
Scheme. be disclosed under the MRC Scheme. 

Q16. Do you have any comments or foresee any practical issues in fulfilling the operational requirements? 

72. | Secured email Als should use secure channels for exchanging MRC information. 





One respondent asked if some technological alignment may be 
needed between reference providing Als and recruiting Als if 
they need to exchange secure emails. 


Secure email (e.g. ICLNet secure email) is an example of such 
channel. Details can be worked out by the IWG. 
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As set out in paragraph 58 of the Consultation Paper, going forward, 
the industry is encouraged to consider developing application 
programming interface (API) based application or other advanced 
technology such as blockchain based solution for exchange and 
maintenance of MRC information. 








Q17. 


Do you have any comments on the proposal for an internal network of an industry association to facilitate the exchange of requests 
and information under the proposed MRC Scheme? 








73. | Challenges in adopting API In view of the potential technical challenges and resources 
Respondents generally considered there are technical | constraints faced by Als, exploration of the feasibility of a computer 
challenges in implementing API for the MRC Scheme. Using the | network at the industry association level may be deferred to the 
API framework would also require further discussion on the | longer run taking into account Als experience in operating the MRC 
types of and the extent of information that Als are expected to | Scheme as well as market feedback and developments. The IWG may 
share. Due consideration should be given to data privacy | further consider the matter. 
concerns and compliance with the PDPO. Respondents also 
expressed difficulties with obtaining extra resources to establish 
relevant technicalities. 

Q18. Do you have any comments on implementing the proposed MRC Scheme through an industry-led effort with the endorsement of 


the HKMA, rather than a supervisory requirement upfront? 








74. 





Retention of employees' personal data 

One respondent sought clarification on the requirements 
regarding the retention of employees’ MRC data and those from 
unsuccessful job applicants, and the right of deletion of their 
personal data. 


The PCPD has provided comments on these areas which are 
summarised below - 


All Als should implement a data retention policy for MRC data. 


Regarding the personal data of an unsuccessful job applicant, 
generally speaking, all recruiting Als should not retain the same for a 
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period longer than 2 years from the date of rejecting the applicant 
unless there is a subsisting reason that obliges the recruiting Al to 
retain the data for a longer period or that job applicant has given 
consent. Hence, recruiting Als, upon receiving MRC information from 
reference providing Als, shall not keep the data of unsuccessful job 
applicants for more than 2 years unless there are special 
circumstances warranting them to do so. These special 
circumstances, if any, should be clearly documented. 


All Als should take all practicable steps to maintain the accuracy of 
personal data retained for purposes that continue after an employee 
has left the Al. 





75. 


Monitoring Als' compliance with MRC Scheme 
Respondents sought clarification on how the HKMA will monitor 
Als’ compliance with the MRC Scheme. 


It is proposed that a review will be conducted two years after the 
implementation of Phase 1 to assess Als’ operation experience and 
effectiveness of the MRC Scheme. In the meantime, the IWG may 
also serve to solicit industry feedback on MRC implementation issues 
on an ongoing basis. If there is any matter that warrants further 
escalation, it could be made to the HKMA through the IWG. 








76. 





Supervisory approach 

One respondent considered that the industry-led approach 
provides flexibility, and it would allow Als to develop industry 
standards in a gradual and progressive manner. However, given 
the wide scope of Phase 2, implementation via a supervisory 
requirement would enhance certainty and avoid unnecessary 
disputes. 





The HKMA would take into account the comments received from the 
review of Phase 1 and the consultation for Phase 2, and consider the 
approach best suited for the MRC Scheme going forward. 
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77. | Role of HKMA The HKMA invites HKAB to set up an IWG to formulate, within 6 
One respondent sought clarification in relation to industry-led | months of the issuance of the Conclusions Paper, operational details 
approach on the meaning of “endorsement by the HKMA” and | of the MRC Scheme, in accordance with the principles set out in the 
the role of HKMA in such an approach. Conclusions Paper, for endorsement by the HKMA. The IWG will also 
serve to review implementation issues on an ongoing basis during 

Phase 1. 
The HKMA will facilitate discussion among industry participants and 
provide guidance on the development and implementation of the 
MRC Scheme as necessary, and monitor the effectiveness of the MRC 

Scheme. 
Q19. Do you have any comments on confining the mandatory reference checking within the Hong Kong banking industry at the beginning? 
78. | Implementation of MRC within the Hong Kong banking Taking into account feedback of some respondents that the turnover 





industry 

Respondents generally agreed to confine the MRC Scheme to 
the Hong Kong banking industry initially and further expand its 
coverage to other financial sectors and other jurisdictions in the 
longer run. Some respondents suggested to conduct a pilot 
MRC Scheme amongst major retails banks before extending it to 
all Als to better address any operational hurdles before the 
Scheme is extended to the entire banking industry. 


of Phase 1 personnel would likely be low given their seniority, it is 
considered undesirable for the scope of the MRC Scheme to be 
further confined to only a few major retail banks at the beginning as 
doing so will render the number of cases even lower for the MRC 
Scheme to generate any meaningful insight. Moreover, doing so 
would make it difficult to assess the effectiveness of the MRC Scheme 
in foreign bank branches. We therefore consider that the confined 
coverage of Phase 1 would be sufficient to serve the purpose of 
having some form of a “pilot scheme” before the further expansion 
of the Scheme to Phase 2. The feedback received on Phase 1 
implementation can serve to identify room for further refinement for 
Phase 2 implementation. 
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Comments / questions from respondents 


HKMA’s response 





Q20. 


Do you have any other comments on the proposed MRC Scheme and other suggestions that can help to tackle RBA phenomenon? 





PCPD comments 

Some respondents considered the proposed MRC Scheme may 
potentially have implications for individuals’ privacy, and as such 
it may be appropriate for the HKMA to consult with the Office 
of the Privacy Commissioner for Personal Data. 


The PCPD had provided valuable comments to the Consultation 
Paper, which have been taken into account. Details of PCPD’s 
comments can be found at Annex 3 — Summary of Comments of the 
PCPD in response to Consultation on Implementation of MRC 
Scheme. 





80. 


Request for MRC information for prospective employees not 
yet in scope 

One respondent noted that recruiting Als shall refrain from 
requesting MRC information for prospective employees that are 
not yet in scope so that resources can be focused on the Phase 
1 and Phase 2 individuals. 


To avoid a sudden surge of MRC requests, Als are suggested to follow 
the implementation timeline and the stipulated coverage of 
personnel under Phase 1 and Phase 2 of the MRC Scheme. 








81. 





Use of CR 

One respondent considered that the use of CR would be 
operationally more efficient especially for the implementation 
of Phase 2 which involves a much broader scope of employees. 





As mentioned in paragraph 26 of the Consultation Paper, the 
adoption of CR can be explored in the longer term if necessary. 
However, the implementation of a CR aiming at covering all existing 
and previous employees of Als in Hong Kong will be operationally 
more complex, involving higher costs and more efforts from Als, 
especially having regard to the necessary arrangements to protect 
personal data privacy. The governance, operational and funding 
arrangements of a CR will need to be carefully designed and 
implemented. Subject to industry-wide support, the IWG could 
conduct a feasibility study on the potential for a central register for 
the MRC Scheme to be developed and operated by the industry. 





53 








Comments / questions from respondents 


HKMA’s response 





82. 


CR links with entities outside Hong Kong 

One respondent suggested the HKMA could also work with 
overseas regulators, and exchange data on RBAs, should the 
MRC Scheme be extended to cover overseas entities in the 
future. 


The proposal may be further explored if a CR is to be established 
subject to the operational experience. However, there is currently no 
plan for doing so as the MRC Scheme will be confined to the local 
banking sector initially. 





83. 


MRC information in reference letter 

One respondent proposed to include MRC information in 
reference letters for departing employees as a standard 
practice, especially for those without any misconduct concerns. 
This will enable the individuals to share MRC information with 
prospective employers as soon as possible, hence reducing the 
number of MRC requests reference providing Als may receive. 


The IWG may consider whether to adopt the proposed approach for 
inclusion of MRC Information in reference letter may assist in 
expediting the MRC process. 


However, it should be noted that the reference letters issued to 
departing employees at the time of departure might not have 
covered investigations conducted subsequent to the departure of the 
employees from the Als concerned. 








84. 





Publicity campaign 

One respondent suggested the HKMA to conduct continuous 
publicity campaigns to promote the MRC Scheme requirements 
so that Als, as well as prospective employees, are more aware 
of their obligations and the impact of the MRC Scheme. 





Given the MRC Scheme serves to improve the current reference 
checking process of Als thereby addressing the RBA phenomenon in 
the industry, we welcome any _ industry-led education and 
communication programme to promote awareness of the MRC 
Scheme among industry participants. Industry associations may 
consider organising workshops and training programmes for relevant 
personnel in Als so as to get them better prepared for the 
implementation of the MRC Scheme. 
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Annex 3 — Summary of Comments of the PCPD in 
response to the Consultation on Implementation of 
Mandatory Reference Checking Scheme 


General Comments 


1. The overriding principle is that any measures that may intrude personal 
data privacy should be necessary, appropriate and proportionate to the 
purposes to be achieved. 


2. The PCPD fully appreciates the adverse consequences of RBA and the 
operational, reputational and financial risks that would be brought to the 
recruiting banks as depicted in the Consultation Paper. The limitations of 
the existing mechanism (which is not aimed specifically at tackling the RBA 
phenomenon) has also given rise to a pressing need for the proposed MRC 
Scheme. 


3. The PCPD also notes that the MRC scheme will adopt a proportionate 
approach and confine to specific categories of employees of the banks 
whose conduct and integrity are more important and the need for 
addressing the RBA phenomenon is of relatively higher priority. The PCPD 
acknowledges that the information about an employee’s conduct would be 
important to the recruiting banks in relation to the inherent nature of the 
job for which the employee is appointed. 


Specific Comments 


Collection of the specific information regarding the conduct of the prospective 
employee 


4. The PCPD notes that under the MRC scheme, information regarding an 
employee’s conduct will be collected by his/her employer throughout the 
employment and the records will be retained by the employer for 10 years. 


5. While it is reasonable and legitimate for employers to maintain 
employment records and information an employee’s conduct (such as 
written records of disciplinary proceedings) in the course of employment, 
Data Protection Principle (DPP) 1(3) requires data users (i.e. the employers) 
to take all practicable steps to ensure that employees are informed of 
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certain matters in relation to the collection of their personal data, such as 
the purpose for which the data is to be used and the classes of persons to 
whom the data may be transferred. 


6. Hence, upon implementation of the MRC Scheme, employers shall 
inform their employees that the type of data (including specific information 
regarding employees’ conduct) that will be collected, how they will use the 
data and how they will transfer the data to prospective recruiting banks for 
reference checking. This notification requirement can be made in the form 
of a written Personal Information Collection Statement (PICS) pertaining to 
employment. 


Accuracy and Duration of Retention of the employees’ personal data 


7. The proposed duration of MRC information would cover the 
prospective employee’s employment records in the past 10 years up to the 
date of application for employment. The PCPD notes that this proposal is in 
line with the HKMA’s existing requirement that 10 years of employment 
records need to be disclosed by applicants in their applications to take up 
positions of directors, chief executives, alternate chief executives and 
executive officers. 


8. For the purpose of the MRC scheme, all banks would have to maintain 
employment records of their employees who have ceased to be employed 
by the banks for a period of at least 10 years counting from the date of the 
employees’ departure from the banks. 


9. Pursuant to DPP2(2), all practicable steps must be taken to ensure that 
personal data shall not be retained longer than is necessary for the 
fulfilment of the purposes (including directly related purposes). Section 26 
of the PDPO also requires that all practicable steps shall be taken to ensure 
erasure of personal data that is no longer required unless it is prohibited by 
law, or in the public interest not to do so. Contravention of section 26 of 
the PDPO is liable to criminal prosecution. 


10. Generally speaking, an employer should implement a written data 
retention policy that specifies a retention period of no longer than seven 
years in respect of employment-related data held about an employee from 
the date the employee leaves employment unless there is a subsisting 
reason that obliges the employer to retain the data for a longer period or 
the former employee has given prescribed consent for the data to be 
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retained beyond seven years. As the MRC Scheme is for the legitimate 
purposes of tackling RBA issue and enhancing the integrity of the banking 
industry, the PCPD generally considers it as a subsisting reason and in the 
public interest for the employer to retain the data for a longer period. 


11. Having said that, the PCPD considers that it would be fair if the 
employees are given a right to request for deletion of their data in specified 
circumstances, for example retirement and permanent departure from 
Hong Kong. Under these circumstances, it would no longer be necessary for 
the employers to retain the personal data of those employees. 


12. Regarding the personal data of an unsuccessful job applicant, generally 
an employer should not retain the same for a period longer than two years 
from the date of rejecting the applicant unless there is a subsisting reason 
that obliges the employer to retain the data for a longer period or the 
applicant has given prescribed consent. Hence, the recruiting banks, upon 
receiving the information from the reference providing banks, shall not keep 
the data for more than 2 years unless there are special circumstances 
warranting it to do so. These special circumstances, if any, shall be clearly 
documented. 


13. The PCPD notes that all information provided under the proposed MRC 
Scheme should be supported by written documents, and to the best 
knowledge of the reference providing banks are being true, fair, complete, 
accurate and capable of substantiation. The PCPD agrees that accuracy and 
completeness of the employment records are imperative to the successful 
implementation of the MRC Scheme, not to mention that data accuracy is 
an essential element from the perspective of personal data privacy. In 
accordance with the requirements under DPP2(1)(a), an employer should 
take all practicable steps to maintain the accuracy of personal data retained 
for purposes that continue after the employee has left employment. 


Consent by the Prospective Employee 


14. In general, DPP3 provides that personal data shall not be used 
(including disclosed or transferred) by a data user (e.g. a frontline 
professional) for a new purpose without the express and voluntary consent 
of the data subject. 


15. The PCPD notes that it is proposed that written consent should be 
obtained from the prospective employee to, inter alia, authorise the 
recruiting bank to conduct reference checking with his/her current and 
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former employer banks and authorise the reference providing banks to 
disclose his/her employment records to the recruiting bank. The PCPD takes 
the view that obtaining an informed consent from the prospective employee 
is necessary, as this would ensure that the data subject consents to such 
disclosure and that the former employers could rely on the consent to 
proceed with the reference checking. 


16. As the purpose of the MRC scheme is for the prospective employer to 
check the integrity of the prospective employee in a recruitment process, 
the prospective employer shall not use (including disclosure or transfer to 
any third parties) the employee’s personal data for a new purpose. Noting 
that the proposed employee’s consent only covers the prospective 
employer to conduct reference checking and the former employers to 
provide the records to the prospective employer, any further use of the 
employees’ data for a purpose not directly related to these purposes would 
be considered as a new purpose and a fresh prescribed consent shall be 
obtained from the employee concerned. 


An opportunity to be heard 


17. It is noted that under the proposed MRC Scheme, the recruiting bank 
would provide the prospective employee with an opportunity to be heard in 
case there is any negative information from the reference providing banks. 
From the perspective of personal data privacy, this proposal would be in line 
with DPP6 and section 22 of the PDPO, which provides data subject a right 
to request correction of inaccurate personal data. As a matter of good 
practice, employers should implement measures and have policies and 
procedures in place to ensure that they can comply with a data correction 
request made by a job applicant, current or former employee. 


Security of the personal data 


18. The PCPD notes that under the proposed MRC Scheme, all banks should 
put in place adequate internal systems and controls, policies and procedures 
to safeguard integrity and confidentiality of information obtained and 
processed during the MRC process. 


19. Pursuant to DPP4(1)(a), the kind of data and the harm that could result 
in case of unauthorized or accidental access are some of the factors to be 
considered when specifying the degree of security measures required. 
Hence, safeguards or security treatment should be commensurate with the 
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sensitivity of the personal data. As the employment records and conduct of 
an employee are rather sensitive and may bring grave harm to a data subject 
if leaked, it is important to put in place adequate security measures to 
ensure that the data is securely kept and transmitted. 


20. Adequate security measures shall be in place to prevent unauthorized 
access to any computer system, file(s) and/or cabinet(s) storing the 
employees’ personal data. This would include, but not limited to, (1) proper 
access control defining who can access the data, such as multi-factor 
authentication before retrieving any data inside in the system and access to 
data by designated staff only for a legitimate purpose; (2) locking the 
cabinet(s) and (3) encrypting the data if needed to be transmitted and 
during storage. 


Data Ethics 


21. In addition to compliance with the requirements under the PDPO, data 
users shall also uphold the principles of accountability and data ethics when 
collecting and using personal data. It would therefore be important to 
observe the principles of explainability and transparency having regard to 
the rising expectations of the public. The ethical elements of data 
protection (namely being fair, respectful and beneficial) will bridge the gap 
between legal requirements and stakeholders’ expectations. 
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